Centos7.5常用firewall

firewalld设置NAT规则上网

1、富规则设置NAT上网

firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=192.168.0.0/16 masquerade'
为默认区域添加NAT规则,允许指定192.168.0.0/16上网

2、直接通道模式设置上网
firewall-cmd --direct --passthrough ipv4 -t nat -A POSTROUTING -s 192.168.88.0/24 -o ens32 -j SNAT --to 192.168.9.37

firewall-cmd --zone=public --direct --passthrough ipv4 -t nat -I POSTROUTING -s 192.168.88.0/24 -j SNAT --to 192.168.9.50

firewall-cmd --permanent --direct --passthrough ipv4 -t nat POSTROUTING -o eth0 -j MASQUERADE

3、标准设置上网
firewall-cmd --zone=public --add-masquerade
4、跳转到内部指定端口服务器-DNAT
firewall-cmd --add-forward-port=port=1111:proto=tcp:toport=22:toaddr=192.168.88.146

firewall-cmd --zone=public --add-rich-rule='rule family=ipv4 forward-port port=80 protocol=tcp to-port=80 to-addr=192.168.10.20'

ipv4 filter FORWARD 1 -d 192.168.10.20 -p tcp --dport 80 -j ACCEPT
ipv4 nat PREROUTING 0 -d 172.16.12.140 -p tcp --dport 80 -j DNAT --to 192.168.10.20:80

firewall-cmd --direct --add-rule ipv4 nat PREROUTING 0 -d 172.16.12.140 -p tcp --dport 80 -j DNAT --to 192.168.10.20:80

其它规则

firewall-cmd --direct --remove-rule ipv4 nat PREROUTING 0 -p tcp --dport 33 -j ACCEPT
使NAT转入到33端口的规则失效

firewall-cmd --direct --add-rule ipv4 filter INPUT 0 -p tcp --dport 33 -j DROP
拒绝到本机的33端口